Search code examples
asp.netdlliis-7.5dll-injection

Hook dll is generating both 32 and 64 bit logs


I have an environment setup that monitors a sample dotnet application running under IIS. I am using hook, profiler and tracker dll's to monitor. The Hook dll is being used by w3wp process. But the other two dll's are not been accessed by IIS worker process. This Hook dll is actually sets environment variables COR_PROFILER, COR_ENABLE_PROFILING and COMPLUS_ProfAPI_ProfilerCompatibilitySetting correctly but still profiler dll is not been accessed by worker process. I have registered dll's for both 32-bit and 64-bit. And strangely the hook dll that getting used by worker process is 32-bit dll but the logs written for hook dll are generating for both 32bit and 64 bit instead of only 32 bit logs. Could any one suggest where could be the problem is?


Solution

  • Realized later that the hook dll is been accessed from Windows\System32 directory, not the actual location where the dll is been present. So which ever application is opened, based on 32-bit/64-bit respective 32/64 bit dll is been accessed and corresponding logs are been printed.